This is a place for me to ruminate about Privacy. Since I work as Google's Global Privacy Counsel, I need to point out that these ruminations are mine, not Google's. Please don't attribute them to Google.

Thursday, December 6, 2012

My Italian Appeal

My Google
colleagues David Drummond, George De Los Reyes (now retired) and myself were
convicted in Milan, Italy in 2010 for violating
Italian privacy law. We have appealed
these convictions. The first appellate
hearing took place in Milan on December 4. I attended the hearing in person. The next hearing will take place on December
11. I want to describe this appeal,
and the broader issues at stake in this appeal, from my personal perspective.

First, a review of the facts: in 2006,
students at a school in Turin, Italy filmed and then later uploaded a video to
Google Video that showed them bullying an autistic schoolmate. Google Video was a predecessor to YouTube. The video was totally reprehensible and
violated Google Video’s terms and conditions of service. Google took it down within hours of being
notified by the Italian police of the presence of the offensive video,
consistent with its policy to remove any content that violates the terms and
conditions of service. Indeed, Google had clear
policies and processes in place to help ensure that objectionable content was
dealt with swiftly and effectively. Google also worked with the local
police to help identify the person responsible for uploading it and she was
subsequently sentenced to 10 months' community service by a court in Turin. Several
other classmates who were involved, as well as the teacher who failed to stop
the offensive conduct, were also disciplined.

In these rare but unpleasant cases, that's where Google’s involvement would
normally end. Under
European law, hosting platforms that do not create content, such as Google
Video, YouTube, Bebo, Facebook, and even university bulletin boards, are not
legally responsible for the content that others upload onto these sites. But
in this instance, a public prosecutor in Milan decided to charge us with
criminal defamation and a failure to comply with the Italian privacy code. None of us, however, had anything to do with
this video. We did not appear in it, film it, upload it or review it. None of us
knew the people involved or were even aware of the video's existence until
after it was removed.

Nevertheless,
in 2010 a judge in Milan convicted the three of us for failure to comply with
the Italian privacy code and sentenced us to six-month suspended jail
sentences. We were all found not guilty
of criminal defamation. This ruling means that employees of hosting platforms
like us can be held criminally responsible for content that users upload, even
if we’re completely unaware of the content. We are now appealing this
extraordinary decision both to clear our names and because it represents a serious misunderstanding of privacy law online
and a threat to freedom on the web.
European Union law gives hosting providers protection from liability so
long as they remove illegal content once they are notified of its existence in
order to provide protection for hosting providers and their employees in
exactly this circumstance. Sweeping
aside this important principle and attacking the very freedoms on which the
internet is built threatens the continued availability of sites that accept
user generated content.

Although we were convicted of violating the student’s
privacy, it is the bullies who took the video and put it up on the site, in
violation of the representations that they made to Google regarding the content
of the video. It is those bullies who should
be, and have already been, held legally responsible for failing to comply with
their obligations under the privacy law.

The European Union's Electronic Commerce Directive,
enacted in 2000, sets a clear legal framework for establishing liability for
unlawful content on the Internet. It prevents liability for those who merely
provide the forum for sharing user generated videos, drawing a clear line
between those who develop and control content for the Internet, and those who,
in their capacity as technological intermediaries, provide the means and the
tools to make this content publicly available.

By establishing legal certainty and creating a single
EU-wide standard, the E-Commerce directive allows the development of open
platforms that promote free expression on an unprecedented scale and has played
a crucial role in speeding the rapid growth of the Internet and the development
of the new economy in Europe.

How does the E-Commerce prescription work in real
life? Say an Internet user uploads a video filled with illegal hate speech or
violence. When notified of this illegal content, the hosting platform is
obliged to take it down. The hosting platform, however, is not obliged to
monitor and prevent the upload. The guilty party is the Internet user who posts
the content. In this case, Google did exactly what the E-Commerce directive
requires - it removed the content upon notification, and took the further step
of cooperating with law enforcement requests, helping to bring the wrongdoers
to justice.

If Google and companies like it were responsible for
every piece of content on the web, the Internet as we know it today – and all
of the economic and social benefits it provides –could not continue. Without appropriate protections, no company or
its employees would be immune: any potentially defamatory text, inappropriate image,
bullying message or video in which third parties appear would have the power to
potentially shut down the platform that had unknowingly hosted it.

Google and other Internet hosting platforms require
legal certainty with respect to their liability. By retroactively creating new
obligations for hosting platforms – and attaching criminal penalties for
employees like us – this conviction destabilizes the certainty of law.

The judgment also criticizes Google’s terms and conditions
of services included in its agreements with users of its video sharing service,
suggesting that Google buried it in difficult to understand privacy clauses
characterized as a “prefabricated alibi.” Yet all types of businesses, from
financial and retail to Internet companies operate with consumers on the basis
of similar contractual terms of service.

The judgment’s reasoning subjects hosting providers
and their employees to uncertain and progressively higher standards as
technology advances. What new legal obligations might be imposed in the next
case before a criminal court? It is this uncertainty which menaces Internet
freedom. In his closing lines, the judge himself raises this dangerous
possibility - “There is no doubt that
the amazing speed with which technology is advancing will allow the managers of
web sites to control the uploading of content,” he writes. “The existence of
increasingly sophisticated pre-screening filters will imply great
responsibility for operators. Criminal liability (negligent or willful as the case
may be) for omitting to carry out checks will be a lot easier to find.” While
this may have been the view of the trial judge, it was not the view of the
Italian Parliament when it implemented the EU directives providing for
protection for hosting intermediaries like Google. We do not share the judge’s
view of a future internet where hosting companies monitor and prescreen all of
the content uploaded by its users and unilaterally determine what will be
available for sharing with others.

By criminally prosecuting individuals like us who
were not connected to the video at issue, this case represents a dangerous
precedent. To seek criminal penalties against employees just because they work
for a company that provided a hosting platform is a chilling prospect, and
threatens to have a substantial impact on the future development of the
Internet.

The real culprits, the teenagers who bullied their
classmate and uploaded the video of it, and the teacher who permitted it to
occur have already been identified and punished. The entire matter should end there.

5 comments:

Has Google's video flagging for inappropriate content procedure been considered as a relinquishment of liability exceptions set forth by Electronic Commerce Directive in favour of Internet companies? Is the ruling been issued without making any consideration in this regard?

I was wondering if this Italian judge realized that filtering uploading content could be an impressive privacy issue as long as internet companies will be taking automatic decisions that could seriously affect people rights and freedoms

I was sorry to read today that the prosecutor is still, inconceivably, seeking jail time for you and your colleagues. I've blogged about the case at http://tourolawiblt.blogspot.com/2012/12/peter-fleischer-other-google-execs.html . {Jonathan}

Peter,Prison time seems like an absurd request but the Italian criminal justice system seems a mystery. Prison time for seismologists while letting hijackers of Achille Lauro and killers of Leon Klinghoffer go with a slap on the wrists.

A very good a cogent explanation of the policy that underpins the 2000 Electronic Commerce Directive. It seems to me that this alone should have been sufficient to negate the Defamation charge.

There is, however, one issue you did not address that puzzles me.

Article 1(5)of the Ecommerce Directive described a number of areas that are excepted from coverage. The Ecommerce Directive principles you cite do not, for example, serve as a shield from liability arising under tax law or competition law.